Dynamic filter generation and distribution within computer networks

ABSTRACT

Systems and methods for implementing filters within computer networks include obtaining blocklist data that includes blocklist entries for a network. Each of the blocklist entries includes one or more network traffic attributes for identifying traffic to be blocked. In response to receiving the blocklist data, a filter based on a common network traffic attribute shared between at least two of the plurality of blocklist entries is generated. The filter is then deployed to a network device within the network such that the filter may be implemented at the network device to block corresponding traffic.

CROSS-REFERENCE TO RELATED APPLICATION

This application is related to and claims priority under 35 U.S.C. §119(e) from U.S. Patent Application No. 62/778,130, filed Dec. 11, 2018entitled “Dynamic Filter Generation and Distribution Within ComputerNetworks,” the entire contents of which is incorporated herein byreference for all purposes.

TECHNICAL FIELD

The present disclosure relates to implementing filters within a networkenvironment and, in particular, to systems and methods for generatingand distributing filters to devices within the network environment.

BACKGROUND

Computing devices, including laptops and smartphones, connected to theInternet or other networks are generally confronted by interminablesecurity risks. For example, the Internet is plagued by numerousmalicious actors utilizing various forms of malware to damage or disablecomputing devices or systems, steal data, interrupt communications,extort businesses or individuals, and/or steal money, among othernefarious acts.

Despite the variety of cyberattack methods, there is commonality in thatmany fundamentally rely on transmitting data over a network.Accordingly, to the extent network traffic associated with maliciousactivity can be readily identified, such traffic can be rerouted and/orblocked, thereby thwarting or at least mitigating potential harm causedby the malicious activity. To that end, various devices within a networkmay include hardware- and/or software-based filtering functionality thatmay be configured to identify traffic having particular characteristicsindicative of malicious or otherwise undesirable activity. When thefilters identify such traffic, the devices block or quarantine thetraffic, mark the traffic for further analysis, or take other similarremedial measures.

It is with these observations in mind, among others, that variousaspects of the present disclosure were conceived and developed.

SUMMARY

In one aspect of the present disclosure, a method of implementingfilters within a network is provided. The method includes generating afilter from blocklist data. The blocklist data contains a plurality ofblocklist entries and each blocklist entry includes network trafficattributes. Generating the filter includes grouping the plurality ofblocklist entries into one or more sets according to the network trafficattributes, each set including blocklist entries having at least onecommon network traffic attribute. Generating the filter further includesgenerating a filter rule for identifying network traffic having thecommon network traffic attribute. The method further includes deployingthe filter to a network device by implementing the filter rule at thenetwork device.

In another aspect of the present disclosure, a non-transientcomputer-readable storage medium is provided. The non-transientcomputer-readable storage medium has instructions embedded thereon thatare executable by one or more processors. When executed, theinstructions cause the processor to perform a method for implementingfilters within a network. The method includes generating a filter fromblocklist data. The blocklist data contains a plurality of blocklistentries and each blocklist entry includes network traffic attributes.Generating the filter includes grouping the plurality of blocklistentries sets according to the network traffic attributes such that eachset includes blocklist entries having at least one common networktraffic attribute. Generating the filter further includes generating afilter rule for identifying network traffic having the common networktraffic attribute. The method further includes deploying the filter to anetwork device by implementing the filter rule at the network device.

In yet another aspect of the present disclosure, a system forimplementing filters within computer networks is provided. The systemincludes one or more hardware processors and a memory storingmachine-readable instructions that, when executed by the one or morehardware processors, cause the one or more hardware processors to obtainblocklist data including a plurality of blocklist entries for a network,each of the plurality of blocklist entries including one or more networktraffic attributes. The instructions further cause the hardwareprocessors to generate a filter based on a common network trafficattribute shared between at least two of the plurality of blocklistentries and deploy the filter to a network device within the network.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an example network environment including a filter managementsystem for generating and updating filters within the networkenvironment.

FIG. 2 is a flow chart illustrating a method for generating anddistributing filters within a network environment.

FIG. 3 is a diagram illustrating an example of a computing system whichmay be used in implementing embodiments of the present disclosure.

DETAILED DESCRIPTION

Telecommunication or other types of computer networks provide for thetransmission of information among devices. Such communications mayinvolve voice, data, multimedia information, software (including patchesand updates), and various others forms of digital content, and digitalservices, among many other things. Such networks include servers orother computing and storage resources from which various forms ofdigital content and network services can be supplied to some device ordevices—e.g., a client device. Networks also include a myriad of otherdevices involved in establishing and maintaining connections andcoordinating the flow of data between devices over the network.

Computer networks are frequent targets for a wide range of activityaimed to steal information, disrupt functionality of components withinthe network, distribute viruses and malware, and any other of a widerange of threats to modern computing systems. In light of such risks,operators of modern networks, users at all points in the chain ofcommunication, and network equipment manufacturers are constantly tryingto develop and improve on existing techniques to identify and eliminatemalicious traffic within computer networks.

With such a goal in mind, among others, the present disclosure providessystems and methods for generating filters and distributing such filtersto devices within a computer network. In general, such systems andmethods include a filter management system that uses a collection ofidentified threats, referred to herein as “blocklist data”, to generatea one or more filters that may be implemented in networked deviceshaving filtering functionality. The blocklist data may be regularlyupdated and filters based on the blocklist data may be regularlyregenerated and redistributed, thereby providing improved securitywithin the network.

The filter management system generates the filters by identifying commonattributes of entries within the blocklist data such that a singlefilter or filter rule may be generated that encompasses multipleblocklist entries. In one example, the filter management system mayanalyze source or destination IP address information maintained in theblocklist data and may identify common data patterns, at the bit, byte,or other delineations, within such IP addresses. The data patterns maythen form the basis of a filter generated by the filter managementsystem.

Filters generated by the filter management system may be distributed toa wide range of devices within a network including end user devices,routers, switches, firewalls, intrusion prevention systems, gateways,and other types of network equipment. In certain cases, the filtersgenerated by the filter management system may be implemented as hardwarefilters. When implemented as hardware filters, additional softwarefiltering functionality by the device may also be implemented to performdeeper analysis of packets/traffic captured by the hardware filter. Suchsoftware filtering may also be supported by the filter managementsystem, such as by the filter management system providing portions ofthe blocklist data to the device.

FIG. 1 is a block diagram of an example network environment 100. Thenetwork environment 100 includes a client device 108 in communicationwith a server 120 via multiple network devices, and, more specifically,network devices ND-1 to ND-5 110-118. As illustrated in FIG. 1, theclient device 108 and ND-1 110 are components of a first network 102,ND-2-ND-4 112-116 are components of a second network 104, and ND-5 118and the server 120 are components of a third network 106.

The network environment 100 is intended merely as an example toillustrate the various concepts of the present disclosure. In otherimplementations, more or fewer networks or subnetworks may be presentwith each network or subnetwork including more or fewer network devicesthan illustrated in FIG. 1. Moreover, the client device 108 and theserver 120 are simply provided as examples of computing devices that maycommunicate over a network. Accordingly, while described herein as aclient device 108 and a server 120 for purposes of context, each of theclient device 108 and the server 120 may be any suitable computingdevice.

Each of ND-1 110, ND-3 114, server 120, and DNS server 130 areillustrated as including respective filters 132 a-132 e. The filters 132a-132 e are configured to receive and analyze network traffic (incomingand/or outgoing) and to apply one or more filter rules that determinewhether such traffic has one or more attributes. If the traffic does notinclude the attributes, the traffic is passed through the filter. If, onthe other hand, the traffic includes the attributes, additional actionsare taken. In certain cases, the traffic may be “sunk” or otherwiseblocked. In other cases, the traffic may be passed through one or moreadditional filters or otherwise analyzed. The particular location offilters 132 a-132 e is intended merely as illustrative of filtering bynetwork edge devices (e.g., ND-1 110), by network devices of a networkbackbone (e.g., ND-3 114), by end user computing devices (e.g., server120), and by DNS components (e.g., DNS server 130). As a result, theparticular locations and number of filters illustrated in FIG. 1 shouldnot be seen as limiting. Rather, implementations of the presentdisclosure may generally include any devices within a network thatsupport filtering functionality and, more specifically, filteringfunctionality that may be dynamically controlled or modified.

During operation, the client device 108 may communicate with the server120 by exchanging packets with the server 120. In one example, theclient device 108 receives, is provided with, or otherwise obtains auniversal resource locator (“url”) and submits a domain of the url to adomain name system (DNS) for resolution. Resolution generally involvesperforming multiple look ups using servers of the DNS (such as DNSserver 130) to determine an Internet Protocol (IP) address correspondingto the domain name, which in the current example is the IP address ofthe server 120. The IP address is then returned to the client device 108such that the client device 108 may connect to and initiate acommunication session with the server 120.

Once a session has been established, packets may be exchanged betweenthe client device 108 and the server 120. In addition to the data beingtransmitted, such packets may include a header with various pieces ofinformation including, among other things, a source IP address and adestination IP address, the latter of which may be used to route thepacket through one or more networks or subnetworks to the server 120.

As illustrated in FIG. 1, multiple network devices may be disposedbetween the client device 108 and the server 120. Such network devicesmay include, without limitation, one or more of switches, routers,firewalls, intrusion prevention systems, gateways, or any piece ofnetwork equipment, and may provide various functions including, withoutlimitation, routing/forwarding of packets, conversion of packets fortransmission between networks using different communication protocols,multiplexing/demultiplexing of data, and the like. One or more of thenetwork devices 110-118, the client 108, the server 120, and componentsof the DNS 128, such as DNS server 130, may be configured to identifyand filter malicious or potentially malicious packets. Such packets mayinclude, among other things, packets associated with a distributeddenial-of-service (DDoS) or other attack, or packets originating from aparticular geographic region known to be a source of hacking or similaractivity. So, for example, a network device may examine various elementsof the packet, such as the source and/or destination address, anddetermine that such elements indicate the packet is associated with orpotentially associated with malicious activity. In response, the packetmay be “sunk”, blocked, or otherwise filtered by the network device suchthat the malicious activity is mitigated.

Packet filtering may be implemented using either hardware or softwareand, in certain cases, a given device may implement both hardware- andsoftware-based filtering mechanisms. In general, hardware-basedfiltering can process packets at a significantly higher rate thansoftware-based filtering but is generally more limited with respect tothe number of filtering rules that may be implemented. Conversely,software-based filtering is a slower but more flexible process thanhardware-based filtering and, as a result, can be implemented to examinea broader range of packets and/or to examine a wider range of packetcharacteristics using more sophisticated rule sets.

In implementations of the present disclosure, filtering of maliciouspackets is facilitated, in part, by a filter management system 122. Thefilter management system 122 has access to or otherwise communicateswith blocklist data 124 that includes listings of IP addresses, IPaddress ranges, domains, or similar identifiers associated with orsuspected of being associated with malicious activity. The blocklistdata 124 may be updated over time as new threats are identified andpotential threats are determined to be benign. The blocklist data 124may be updated by an operator of the filter management system 122. Incertain implementations, however, at least a portion of the blocklistdata 124 may be provided by a third-party, such as a customer for whichdynamic filtering services are provided by an operator of the filtermanagement system 122. In such implementations, a computing device 126may be used by the customer to connect to and provide threat informationto or to otherwise interact with the filter management system 122, whichmay in turn update the blocklist data 124.

During operation, the filter management system 122 processes theinformation stored in the blocklist data 124 to generate filters forimplementation by one or more devices, which may include any of theclient device 108, the server 120, or any of the network device 110-118.The filter management system 122 then transmits the generated filters tosuch devices for implementation by the devices. The filter managementsystem 122 is illustrated as being in communication with each ofnetworks 102-106 and DNS server 130 and is capable of updating hardwareand/or software filters of devices within networks 102-106 and DNS 128;however, in other implementations, the filter management system 122 maybe configured to communicate with only a subset of networks,subnetworks, or devices within a broader network environment. The filtermanagement system 122 may be configured to directly communicate withcomponents of networks 102-106 and DNS 108 to configure filters of suchcomponents or may communicate with one or more intermediate deviceswhich then manage configuration of the component filters.

Processing of the blocklist data 124 by the filter management system 122may be accomplished using various techniques, however, in general, theprocessing step includes the generation of one or more filters that maybe distributed to and implemented in devices associated with the filtermanagement system 122. More specifically, the filter management systemgenerates one or more filters based on common patterns or commonattributes found in entries of the blocklist data 124.

The actual process by which common patterns and/or attributes of theblocklist data entries are identified may vary in applications of thepresent disclosure. However, in general, any computer-implementedprocess for grouping data based on common attributes of the data beinggrouped may be used. So, for example, the filter management system 122may implement one or more machine learning algorithms for efficientlygrouping the data.

In one simple example, suppose the blocklist data 124 includes source IPaddresses 1.2.3.4, 1.5.3.6, and 1.2.3.5. Instead of checking eachaddress individually, the filter management system 122 may insteadgenerate a filter that identifies all traffic having a source IP addressof 1.x.3.y, where x is any value from 2 to 5 and y is any value from 4to 6. As a result, each of the three IP addresses would be capturedusing only a single filter.

In another implementation intended for use in filtering DNS-relatedtraffic, the filter management system 122 may be configured to generatefilters based on attributes of DNS requests. In such implementations theblocklist data 124 may include full domain names or portions of domainnames (e.g., top-level domains, hostnames, etc.) for which requests areto be denied or otherwise blocked. The filter management system 122 mayidentify common attributes of the blocklist entries and generate filtersto block sets of the blocklist entries, e.g., by identifying domainnames (or portions thereof) conforming to a common string pattern. Forexample, if the blocklist included each of the domain names“fakehost.com”, “failhost.com”, and “falsehost.com”, the filtermanagement system 122 may generate a filter that identifies DNS requestsfor domain names based on a data pattern that identifies domain nameswith hostnames beginning with “fa” and ending in “host” within the toplevel domain “.com” (e.g., “fa*host.com”, where * indicates anintermediate string of arbitrary length).

In certain applications, the filters generated by the filter managementsystem 122 from the blocklist data 124 may be a Bloom filter. A Bloomfilter is a probabilistic data set that is used to test whether anelement is a member of a given set. In the current application, the setin question is the blocklist data 124 (or a subset thereof) while theelement or elements in question are properties of a received packet,such as a source IP address and/or a destination IP address. In the caseof filtering by the DNS 128, the element may be a domain submitted bythe client device 108 to the DNS 128. However, more generally, theelement or elements in question may be any attribute associated with agiven packet.

The actual attribute on which packets are filtered may vary based on thecharacteristics of the blocklist data 124 entries and how such entriesare grouped. However, in one example, the filter may filter a sequentialrange of IP addresses that covers a particular subset of the IPaddresses included in the blocklist data 124. In another example, thefilter may filter based on ranges of IP address octets, such as in thepreviously discussed example. In still another example, the filter mayfilter based on specific bits of an IP address (e.g., the filter may beconfigured to filter out all IP addresses where the third, twelfth, andtwenty-eighth bit of the IP address is a “1”). In the case of filteringwithin DNS 128 and as noted above, filtering may also be performed onthe domain name contained in a DNS query. So, for example, filters maybe configured to filter out any DNS requests for particular top-leveldomains (e.g., *.ru) or any domain names containing particular strings,among other things. More generally, however, filtering may be performedon any attributes of network traffic, regardless of the purpose orcontent of the network traffic.

In light of the foregoing, the filter management system 122 processesthe blocklist data 124 to identify common attributes of blocklist data124 entries. Such common attributes are then used to generate acorresponding filter that filters based on the common attributes. Thefilters are then distributed to and implemented in devices of thenetwork environment 100.

Filters generated by the filter management system 122 may be deployed todevices of the network environment 100 in various ways. For example andwithout limitation, deployment may include transmitting areconfiguration message or similar update to devices implementingfilters within the network environment 100. In certain cases, thereconfiguration message or update may instantiate one or more newfilters within the device. Alternatively, the reconfiguration messagemay update or otherwise modify existing filters of the device.

As can be appreciated from the foregoing description, the filtersgenerated by the filter management system 122 may be over-inclusive. Inother words, while the filters discussed above will not result in falsenegatives (i.e., falsely identifying a known threat as benign), thepossibility exists for false positives (i.e., falsely identifying abenign packet as a threat). For example, in the previous example sourceIP address filter of 1.x.3.y, where x is 2 to 5 and y is 4 to 6, apacket having a source IP address of 1.4.3.4 would be captured by thefilter even though it is not one of the three known threat source IPaddresses from which the filter is derived. While examples herein mayuse IPv4 addresses, it should be appreciated that implementations of thepresent disclosure are not limited to IPv4 applications and may beimplemented using other addressing schemes including, withoutlimitation, IPv6.

Because of this over-inclusiveness, filters generated by the filtermanagement system 122 may be implemented as the first of multiplefilters in a given device and may be used to significantly reduce thenumber of packets requests for which additional analysis may berequired. So, for example, a given filter generated by the filtermanagement system 122 may capture 3% of packets for further processingby a secondary filter, but may allow the remaining 97% of packets topass. The captured 3% of packets may then be passed through one or moreadditional filters to further evaluate whether such packets areassociated with a threat and should be blocked.

Based on this multi-filter functionality, in certain implementations thefirst-level filters generated by the filter management system 122 may beimplemented as hardware filters while any secondary filters may beimplemented in software. As a result, relatively high-speed but generalhardware filtering may be leveraged to quickly and efficiently analyzepackets received by a device and significantly reduce the number ofpackets requiring additional analysis. Relatively slower but moresophisticated software filtering may then be performed to more preciselydetermine whether a packet not captured by the hardware filter should,in fact, be blocked.

In certain implementations, the filter management system 122 maygenerate multiple sets of filters for use in different parts of anetwork environment or for implementation in different devices. Forexample, in one implementation, the filter management system 122 maymaintain different sets of blocklist data for different networks orsubnetworks (e.g., networks belonging to different customers).Accordingly, the filters generated by the filter management system 122may vary between the any two networks/subnetworks.

In another example, the blocklist data 124 may include a relativethreat-related metric for each entry of the blocklist data 124. So, forexample, a known and verified threat may be assigned a score of 1.0 (ona scale of 0 to 1.0) while a suspected but unverified threat may beassigned a lower score, e.g., 0.6. Accordingly, the score may provide ageneral indication of a confidence level regarding whether the blocklistdata entry indicates an actual threat. Different devices, networks, orsubnetworks may then be assigned different security thresholds that maythen be used by the filter management system 122 to selectively includeor exclude blocklist data entries when generating filters for thedevices, networks, or subnetworks. For example, the filter managementsystem 122 may be configured to generate filters for a high securitysubnetwork using all blocklist data having a threat score of 0.5 orgreater but to generate filters for a more open subnetwork using onlyblocklist data having a threat score of 0.8 or greater. As a result, thefilters implemented in the high security subnetwork will besignificantly more selective and will identify a higher proportion ofpackets for further analysis as compared to the filters implemented inthe more open subnetwork.

As previously noted, the filter management system 122 may generate andupdate hardware filters of network devices. However, the filtermanagement system 122 may also be used to update, manage, or otherwisefacilitate software filters of such network devices. For example, in oneimplementation, the filter management system 122 may be configured todistribute some or all of the blocklist data 124 to devices for use inperforming software filtering. In another implementation, the filtermanagement system 122 may be configured to receive requests from devicesto verify whether certain packets marked for software-based filteringshould, in fact, be blocked.

In certain implementations, the filter management system 122 may beconfigured to automatically update filters of devices associated withthe filter management system 122. For example, the filter managementsystem 122 may be configured to regenerate filters from the blocklistdata 124 and to redistribute such filters at regular intervals (e.g.,daily, weekly, monthly, etc.). As another example, the filter managementsystem 122 may be configured to regenerate and redistribute filters inresponse to a change in the blocklist data 124 or changes in theblocklist data 124 exceeding a particular threshold (e.g., a certainnumber of new or modified entries). Accordingly, the filter managementsystem 122 may be configured to automatically and dynamically updatefilters within the network environment 100, thereby ensuring that suchfilters are implemented based on current threat information. Instead ofor in addition to such automated operation, the filter management system122 may also be manually activated to generate and/or distribute filtersat a device-specific level, for all devices within a subnetwork ornetwork, or at any other level.

FIG. 2 is a flow chart illustrating a method 200 for implementingfilters in a network environment. To provide context in the foregoingdiscussion, reference is made to FIG. 1 and the various elementsillustrated in the network environment 100 of FIG. 1. In oneimplementation, the method 200 may be executed by a computing system,such as the filter management system 122 of FIG. 1.

At operation 202, the filter management system 122 accesses blocklistdata 124. As previously discussed in the context of FIG. 1, theblocklist data 124 generally includes information corresponding to knownor suspected threats or malicious activity. In one exampleimplementation, the blocklist data 124 may include multiple entries,each entry including information associated with particular traffic tobe monitored and/or blocked. The information contained in the blocklistdata 124 may be provided from various sources including, withoutlimitation, an operator of the filter management system 122 andcustomers for which dynamic filtering services are provided using thefilter management system 122.

The filter management system 122 then processes the blocklist data 124to group the entries of the blocklist data 124 based on commonattributes (operation 204) and, for each group, generates acorresponding filter (operation 206). More specifically, the filtermanagement system 122 processes the blocklist data 124 to find commonattributes shared between multiple entries of the blocklist data 124such that, for each group of blocklist entries including particularcommon attributes, a filter may be generated that captures each of themultiple entries within the group. In one example implementation, theone or more filters generated by the filter management system 122 areBloom filters.

The specific number and scope of the filters generated during operation204 may vary. For example, the number of filters and, as a result, thenumber of blocklist data 124 entries captured by each filter may varybased on, among other things, the number of total blocklist dataentries, the capacity of devices in which the filters are to beimplemented (i.e., certain devices may only be able to implement alimited number of hardware filters), the processing power of suchdevices available for additional analysis of packets identified by thefilter, and risk tolerance, among other things.

In certain implementations, the process of generating filters may takeinto account other factors and business intelligence information. Forexample, the filter management system 122 may vary which blocklist data124 is used to generate the filters based on, among other things,customer preferences, geographic locations, security level requirements,and the like.

At operation 208, the filter management system 122 prepares fordistribution/deployment of the filters by generating one or morereconfiguration messages. A reconfiguration message generally includesdevice parameters, a script, device executable instructions, or thelike, that, when received by a given network device, causes the networkdevice to undergo a reconfiguration process. Each reconfigurationmessage is configured to implement one or more of the filters generatedduring operation 206 by a recipient device. The reconfiguration messagesare then transmitted to respective devices such that the filters may beimplemented (operation 210). Once received, the reconfiguration messagemay be processed by the device to implement the generated filters withinthe device. For example, the device may read and updated filterparameters included in the reconfiguration message or execute a scriptincluded in the reconfiguration message. In other cases, distributionand deployment of the generated filters may include transmitting aspecialized file or package executable or deployable by software on thedevice to install, update, or otherwise modify filter functions of thedevice to reflect the filters generated by the filter management system122.

FIG. 3 is a block diagram illustrating an example of a computing deviceor computer system 300 which may be used in implementing the embodimentsof the network disclosed above. In particular, the computing device ofFIG. 3 is one embodiment of the server or other networking componentthat performs one of more of the operations described above. Thecomputer system (system) includes one or more processors 302-306.Processors 302-306 may include one or more internal levels of cache (notshown) and a bus controller or bus interface unit to direct interactionwith the processor bus 312. Processor bus 312, also known as the hostbus or the front side bus, may be used to couple the processors 302-306with the system interface 314. System interface 314 may be connected tothe processor bus 312 to interface other components of the system 300with the processor bus 312. For example, system interface 314 mayinclude a memory controller 318 for interfacing a main memory 316 withthe processor bus 312. The main memory 316 typically includes one ormore memory cards and a control circuit (not shown). System interface314 may also include an input/output (I/O) interface 320 to interfaceone or more I/O bridges or I/O devices with the processor bus 312. Oneor more I/O controllers and/or I/O devices may be connected with the I/Obus 326, such as I/O controller 328 and I/O device 330, as illustrated.

I/O device 330 may also include an input device (not shown), such as analphanumeric input device, including alphanumeric and other keys forcommunicating information and/or command selections to the processors302-306. Another type of user input device includes cursor control, suchas a mouse, a trackball, or cursor direction keys for communicatingdirection information and command selections to the processors 302-306and for controlling cursor movement on the display device.

System 300 may include a dynamic storage device, referred to as mainmemory 316, or a random access memory (RAM) or other computer-readabledevices coupled to the processor bus 312 for storing information andinstructions to be executed by the processors 302-306. Main memory 316also may be used for storing temporary variables or other intermediateinformation during execution of instructions by the processors 302-306.System 300 may include a read only memory (ROM) and/or other staticstorage device coupled to the processor bus 312 for storing staticinformation and instructions for the processors 302-306. The system setforth in FIG. 3 is but one possible example of a computer system thatmay employ or be configured in accordance with aspects of the presentdisclosure.

According to one embodiment, the above techniques may be performed bycomputer system 300 in response to processor 304 executing one or moresequences of one or more instructions contained in main memory 316.These instructions may be read into main memory 316 from anothermachine-readable medium, such as a storage device. Execution of thesequences of instructions contained in main memory 316 may causeprocessors 302-306 to perform the process steps described herein. Inalternative embodiments, circuitry may be used in place of or incombination with the software instructions. Thus, embodiments of thepresent disclosure may include both hardware and software components.

A machine readable medium includes any mechanism for storing ortransmitting information in a form (e.g., software, processingapplication) readable by a machine (e.g., a computer). Such media maytake the form of, but is not limited to, non-volatile media and volatilemedia. Non-volatile media includes optical or magnetic disks. Volatilemedia includes dynamic memory, such as main memory 316. Common forms ofmachine-readable media may include, but are not limited to, magneticstorage media; optical storage media (e.g., CD-ROM); magneto-opticalstorage media; read only memory (ROM); random access memory (RAM);erasable programmable memory (e.g., EPROM and EEPROM); flash memory; orother types of media suitable for storing electronic instructions.

Embodiments of the present disclosure include various operations, whichare described in this specification. The operations may be performed byhardware components or may be embodied in machine-executableinstructions, which may be used to cause a general-purpose orspecial-purpose processor programmed with the instructions to performthe operations. Alternatively, the operations may be performed by acombination of hardware, software, and/or firmware.

Various modifications and additions can be made to the exemplaryembodiments discussed without departing from the scope of the presentinvention. For example, while the embodiments described above refer toparticular features, the scope of this invention also includesembodiments having different combinations of features and embodimentsthat do not include all of the described features. Accordingly, thescope of the present invention is intended to embrace all suchalternatives, modifications, and variations together with allequivalents thereof.

We claim:
 1. A method of implementing filters within a network, themethod comprising: generating a filter from blocklist data, theblocklist data containing a plurality of blocklist entries, eachblocklist entry having network traffic attributes, wherein generatingthe filter comprises: grouping the plurality of blocklist entries intoone or more sets according to the network traffic attributes, whereineach of the one or more sets includes blocklist entries having at leastone common network traffic attribute; and for a set of blocklist entriesof the one or more sets to be filtered, generating a filter rule foridentifying network traffic having the at least one common networktraffic attribute of the set to be filtered; and deploying the filter toa network device by implementing the filter rule at the network device.2. The method of claim 1, wherein the filter is a Bloom filter generatedfrom the blocklist data.
 3. The method of claim 1, wherein the networktraffic attributes of each of the plurality of blocklist entries includeat least a portion of one of a source address or a destination address.4. The method of claim 3, wherein: the one of the source address or thedestination address is an Internet Protocol (IP) address, grouping theplurality of blocklist entries into one or more sets comprises groupingthe plurality of blocklist entries such that the IP addresses of theblocklist entries in each of the one or more sets have a common IPaddress data pattern, and the filter rule is configured to filternetwork traffic having the common IP address data pattern of the set ofblocklist entries to be filtered.
 5. The method of claim 1, whereingenerating the filter rule comprises generating a data pattern common toeach blocklist entry of the set of blocklist entries to be filtered. 6.The method of claim 1, wherein deploying the filter to the networkdevice comprises implementing the filter rule in hardware of the networkdevice.
 7. The method of claim 6 further comprising transmitting atleast a portion of the set of blocklist entries corresponding to the setof blocklist entries to be filtered to the network device forimplementation in a software filter of the network device.
 8. The methodof claim 1, wherein the network device is a component of a Domain NameSystem (DNS).
 9. The method of claim 8, wherein: the network trafficattributes of each of the blocklist entries include at least a portionof a domain name, grouping the plurality of blocklist entries into oneor more sets comprises grouping the plurality of blocklist entries suchthat the portions of the domain names of the blocklist entries in eachof the one or more sets have a common data pattern, and the filter ruleis configured to filter network traffic having domain names includingthe common data pattern of the set of blocklist entries to be filtered.10. The method of claim 1, wherein deploying the one or more filters tothe network device comprises: generating a reconfiguration message, thereconfiguration message configured to cause the network device toimplement the filter rule in response to receiving the reconfigurationmessage; and transmitting the reconfiguration message to the networkdevice.
 11. The method of claim 1, wherein the network device is one ofa domain name system server, a router, a switch, a firewall, and anintrusion prevention system.
 12. A non-transient computer-readablestorage medium having instructions embodied thereon, the instructionsbeing executable by one or more processors to perform a method forimplementing filters within a network, the method comprising: generatinga filter from blocklist data, the blocklist data containing a pluralityof blocklist entries, each blocklist entry having network trafficattributes, wherein generating the filter comprises: grouping theplurality of blocklist entries into one or more sets according to thenetwork traffic attributes, wherein each of the one or more setsincludes blocklist entries sharing at least one common network trafficattribute; and for a set of blocklist entries of the one or more sets tobe filtered, generating a filter rule for identifying network traffichaving the at least one common network traffic attribute of the set tobe filtered; and deploying the filter to a network device byimplementing the filter rule at the network device.
 13. Thenon-transient computer readable storage medium of claim 12, wherein: thecommon network traffic attributes of each of the blocklist entriesincludes at least a portion of an Internet Protocol (IP) address,grouping the plurality of blocklist entries into one or more setscomprises grouping the plurality of blocklist entries such that the IPaddresses of the blocklist entries in each of the one or more sets havea common IP address data pattern, and the filter rule is configured tofilter network traffic having the common IP address data pattern of theset of blocklist entries to be filtered.
 14. The non-transient computerreadable storage medium of claim 12, wherein: the network trafficattributes of each of the blocklist entries include at least a portionof a domain name, grouping the plurality of blocklist entries into oneor more sets comprises grouping the plurality of blocklist entries suchthat the portions of the domain names of the blocklist entries in eachof the one or more sets have a common data pattern, and the filter ruleis configured to filter network traffic having domain names includingthe common data pattern of the set of blocklist entries to be filtered.15. The non-transient computer readable storage medium of claim 12,wherein the one or more filters are Bloom filters generated from theblocklist data.
 16. The non-transient computer readable storage mediumof claim 12, wherein deploying the filter to the network device includesimplementing the filter as a hardware filter of the network device andthe instructions to further causing the processor to transmit at least aportion of the set of blocklist entries to be filtered to the networkdevice for implementation in a software filter of the network device.17. A system configured for implementing filters within computernetworks, the system comprising: one or more hardware processors; and amemory storing machine-readable instructions that, when executed by theone or more hardware processors, cause the one or more hardwareprocessors to: obtain blocklist data including a plurality of blocklistentries for a network, each of the plurality of blocklist entriesincluding one or more network traffic attributes; generate a filterbased on a common network traffic attribute shared between at least twoof the plurality of blocklist entries; and deploy the filter to anetwork device within the network.
 18. The system of claim 16, whereinthe common network traffic attribute includes at least a portion of adomain name.
 19. The system of claim 16, wherein the common networktraffic attribute includes at least a portion of one of a source addressand a destination address of network traffic.
 20. The system of claim16, wherein the machine-readable instructions cause the one or morehardware processors to: deploy the filter to the network device forimplementation as a hardware filter; and provide at least a portion ofthe blocklist data to the network device for implementation as asoftware filter of the network device.